release: configure npm trusted publishing for all 8 @curatelabs packages

[DecisionNerd]

Summary

Migrate GraphForge npm publication from long-lived NPM_TOKEN (Bypass 2FA) to npm trusted publishing (GitHub Actions OIDC) with provenance attestations, matching PyPI and crates.io.

Acceptance criteria (in-repo)

• publish.yaml npm jobs have id-token: write and do not project NPM_TOKEN / NODE_AUTH_TOKEN
• scripts/publish_npm_artifacts.py publishes with --provenance and routes --package through integrity-resume (publish_one)
• release-credential-preflight.yml and contract tests assert the OIDC / no-token model
• Docs (publication-order.md, RELEASING.md, v0.5 runbook) drop Bypass-2FA / NPM_TOKEN requirements and document npm trusted publishing like PyPI/crates
• Publish-once / attempt-receipt semantics are unchanged

Human console steps (before first OIDC npm publish)

On npmjs.com, configure a GitHub Actions trusted publisher for each of the 8 @curatelabs packages:

1. @curatelabs/graphforge-darwin-arm64
2. @curatelabs/graphforge-darwin-x64
3. @curatelabs/graphforge-linux-arm64-gnu
4. @curatelabs/graphforge-linux-x64-gnu
5. @curatelabs/graphforge-win32-x64-msvc
6. @curatelabs/graphforge
7. @curatelabs/graphforge-cli
8. @curatelabs/graphforge-agent-skills

For each package → Package Settings → Trusted Publisher → GitHub Actions:

• Owner: CurateLabs
• Repository: graphforge
• Workflow filename: publish.yaml
• Environment: leave blank (same as PyPI)

Also confirm the @curatelabs org allows OIDC trusted publishing. For any package that does not yet exist, use npm’s pending trusted-publisher / first-publish flow.

Retire NPM_TOKEN

Only after a successful publish.yaml npm lane authenticates via OIDC:

gh secret delete NPM_TOKEN --repo CurateLabs/graphforge

Rotate any local copies of the former granular Bypass-2FA token.

Out of scope

• Binding RC Bazel cutover
• publish.yaml concurrency / environment keys / stale tag defaults
• Changing publish-once / attempt-receipt semantics

References

• Devinfra Audit priority: npm trusted publishing + provenance

[coderabbitai]

🔗 Related PRs

#204 - chore: prepare npm packages for publishing [merged]
#289 - fix(release): amend unpublished main npm artifact [merged]
#305 - feat(release): orchestrate resumable publication [merged]
#350 - Use crates.io Trusted Publishing for crate releases [merged]
#377 - test(release): isolate npm publication dry-run policy [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[DecisionNerd]

Agent instructions: configure npm trusted publishers (human console gate)

Configure GitHub Actions trusted publishing for all 8 @curatelabs packages, then dry-check credentials. Do not skip packages. Do not leave Environment blank.

Preconditions

1. Logged into https://www.npmjs.com as an org admin for @curatelabs.
2. gh authenticated with access to CurateLabs/graphforge.
3. Confirm in-repo: .github/workflows/publish.yaml npm publish jobs use environment: release and id-token: write.

Critical (stale runbook correction)

Issue #438 body and older runbook text saying Environment: leave blank are STALE.

publish.yaml sets environment: release. Every trusted publisher must set:

Field	Value
Organization / Owner	CurateLabs
Repository	graphforge
Workflow filename	publish.yaml
Environment	release

Mismatch (blank vs release) will fail OIDC publish.

Packages (exactly these 8)

1. @curatelabs/graphforge-darwin-arm64
2. @curatelabs/graphforge-darwin-x64
3. @curatelabs/graphforge-linux-arm64-gnu
4. @curatelabs/graphforge-linux-x64-gnu
5. @curatelabs/graphforge-win32-x64-msvc
6. @curatelabs/graphforge
7. @curatelabs/graphforge-cli
8. @curatelabs/graphforge-agent-skills

Per-package click-path (repeat for each of the 8)

1. Open https://www.npmjs.com/package/<PACKAGE_NAME> (replace with the package from the list).
2. Open Settings (package settings).
3. Open Publishing access / Trusted Publisher (npm UI label may be either; use the Trusted Publisher section).
4. Choose GitHub Actions.
5. Fill exactly:
   • Organization: CurateLabs
   • Repository: graphforge
   • Workflow filename: publish.yaml
   • Environment: release
6. Save / confirm the trusted publisher.
7. If the package does not exist yet, use npm’s pending trusted-publisher / first-publish flow with the same four field values.
8. Mark the package done only after the saved publisher shows:
   • org=CurateLabs
   • repo=graphforge
   • workflow=publish.yaml
   • environment=release

Checklist (tick each after verify)

• @curatelabs/graphforge-darwin-arm64 → Trusted Publisher GitHub Actions configured (CurateLabs / graphforge / publish.yaml / release)
• @curatelabs/graphforge-darwin-x64 → same
• @curatelabs/graphforge-linux-arm64-gnu → same
• @curatelabs/graphforge-linux-x64-gnu → same
• @curatelabs/graphforge-win32-x64-msvc → same
• @curatelabs/graphforge → same
• @curatelabs/graphforge-cli → same
• @curatelabs/graphforge-agent-skills → same

After all 8 configured: dry-check

gh workflow run release-credential-preflight.yml --repo CurateLabs/graphforge
gh run list --repo CurateLabs/graphforge --workflow=release-credential-preflight.yml --limit 1
# Then open the newest run and confirm it succeeds for the npm/OIDC checks.

After first green OIDC npm publish (not before)

Only after a successful publish.yaml npm lane authenticates via OIDC (no NPM_TOKEN):

gh secret delete NPM_TOKEN --repo CurateLabs/graphforge

Also rotate any local copies of the former granular Bypass-2FA token.

Success criteria (agent-verifiable)

1. All 8 packages list a GitHub Actions trusted publisher with Organization=CurateLabs, Repository=graphforge, Workflow=publish.yaml, Environment=release.
2. release-credential-preflight.yml run is green after configuration.
3. A later successful publish.yaml npm publish does not require NPM_TOKEN.
4. After that green OIDC publish, NPM_TOKEN is deleted from repo secrets (gh secret list --repo CurateLabs/graphforge shows no NPM_TOKEN).

Out of scope

• Editing runbooks in-repo
• Changing publish.yaml
• Creating a new GitHub issue